mrcharles
6e4f794b03
ci / audit (push) Failing after 1m1s
compose.yaml: host networking (bridge+embedded-DNS broke rooted-name lookups), :8443 via ca.json address, image digest-pinned; init-stepca.sh: scaffold + ECDSA-P256 intermediate signed by /root/ca-root fleet root (verified), ACME provisioner, managed password. Directory serving RFC8555 on tailnet. OPEN: step-ca validation GET fails instantly with zero dial attempts (authz says could-not-connect) — bisected caps, read_only, bridge vs host, container DNS. Debug continues next run (GODEBUG=netdns=2 + strace plan). https://projects.knownelement.com/issues/800
27 lines
1.2 KiB
YAML
27 lines
1.2 KiB
YAML
# step-ca PROD ACME endpoint on tsys-ca [#800 #697]
|
|
#
|
|
# Bring-your-own-chain: intermediate signed by the fleet root (offline
|
|
# /root/ca-root), served on the TAILNET only. HTTP-01 challenges do NOT hit
|
|
# this box — ACME clients serve them on the target host's port 80.
|
|
#
|
|
# Files expected next to this compose (created by init-stepca.sh):
|
|
# data/ step home (config, certs, secrets; uid 1000)
|
|
# Init (first deploy only): bash init-stepca.sh (run on tsys-ca as root)
|
|
# Verify: curl -k https://100.102.96.24:8443/acme/acme/directory
|
|
#
|
|
# PROVISIONER: ACME provisioner named "acme" is added by init-stepca.sh
|
|
# (step ca provisioner add acme --type ACME) after scaffolding.
|
|
|
|
services:
|
|
stepca:
|
|
image: smallstep/step-ca@sha256:e9e8fa3262bf37b130962ffddbf6a64ac188f0bbb80959cf3ddc04c6bf294c3d
|
|
container_name: ukrrs-oam-ca-stepca
|
|
restart: unless-stopped
|
|
# step-ca validates http-01 by dialing the ROOTED target name; docker's
|
|
# embedded DNS on tsys-ca cannot answer absolute tailnet FQDNs, so pin
|
|
# the tailscale resolver (MagicDNS) explicitly.
|
|
network_mode: host
|
|
volumes:
|
|
- ./data:/home/step
|
|
# hardening (read_only+caps) re-enabled after validation debugging
|